Is AliSave - Download AliExpress Images & Videos safe?

Medium risk

AliSave sends merchant page URLs to alisave.info and can apply server-supplied redirects.

When a tab starts loading an AliExpress, Alibaba, Amazon, or Banggood page, AliSave posts the current page URL and detected merchant to its link-processing endpoint. If that endpoint returns a processed URL, the extension updates the active tab to the returned address.

alisave.infov4.0.1Chrome Web Store
48Risk
Who publishes it

alisave.info - 2 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
alisave.info
Declared legal entity
alisave.info
Registered address
3921 Walnut Ave, Fremont, CA 94538, US
Registered contact
Louis Palumbo
Website
www.alisave.info

Same store account

2 other listings published from this account, 2k+ users between them. 2 of them carry a finding.

AliFast - Download Ali Images & Videos1k+MediumAliSave - Download Ali Images & Videos1k+Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AliSave sends the page you're browsing to alisave.info and can redirect your tab

Our dynamic analysis captured the extension sending the URL of every AliExpress, Alibaba, Amazon, or Banggood page you load to alisave.info.

The response can redirect your active tab when a remote flag is enabled.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You navigate to an AliExpress, Alibaba, Amazon, or Banggood page.

Any URL containing one of those merchant names, or a /product-detail/ path, qualifies.

The extension did this

The extension sends that page's full URL to alisave.info and can replace your tab's address with whatever the server sends back.

This runs automatically, with no click or prompt, as long as a remote status flag is enabled.

What alisave.info receives on every matching page load
  • The page you're on
    https://www.amazon.com/s?k=usb+cable

    The exact address of the merchant page you just opened, including any search terms or product IDs in it.

  • Which merchant
    amazon

    A short code telling the server which shopping site you're using.

Captured request
POSThttps://www.alisave.info/wp-json/alisave/v1/link-processor

200 OK, JSON with success, processed_url, and merchant. Here processed_url matched the original page, so no redirect followed; the code redirects whenever the server returns a different URL.

Headers
Content-Type
application/json
Body
{  "source_url": "https://www.amazon.com/s?k=usb+cable",  "merchant": "amazon"}
The code that does this

The navigation listener and the request it sends

Readable version

Listener + merchant match

Same logic, unminified. The `merchants` object maps a short internal code to a friendly merchant name; the four if/else branches match the current tab's URL against aliexpress, alibaba (also matched by any /product-detail/ path), amazon, and banggood.

The POST and the conditional redirect

processUrlWithAPI() builds the request from three string fragments joined into https://www.alisave.info/wp-json/alisave/v1/link-processor, POSTs the current tab's URL and merchant name as JSON, and returns whatever processed_url the server sends. handleLinkProcessing() then calls chrome.tabs.update() whenever that returned URL differs from the one you were on, sending your tab to it.
Where your browsing URL goes
    • www.alisave.info

    Receives the full URL of every AliExpress, Alibaba, Amazon, or Banggood page you load, and can respond with a URL the extension navigates your tab to.

    • docs.google.com

    Hosts a published Google Sheet the extension polls every minute to decide whether the above behavior is turned on.

Remote kill switch

The extension checks a public Google Sheet once a minute. Only when its text reads exactly "we want to run" does it forward page URLs and honor alisave.info redirects; the developer can toggle this fleet-wide without a new release.

What it can do

Permissions this extension asks for, as declared in version 4.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Read and change your data on www.alisave.info

    https://www.alisave.info/

  • Read and change your data on docs.google.com

    https://docs.google.com/

  • Store data in your browser

    storage

  • Start, monitor and manage your downloads

    downloads

  • See the address and title of every tab you have open

    tabs

  • Schedule its own background tasks

    alarms

Where it sends data

Destinations our analysis observed AliSave - Download AliExpress Images & Videos contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.alisave.info

    AliSave - Download AliExpress Images & Videos sends data to www.alisave.info. No other extension we have analysed sends data here.

Updated 30 September 2026kcjlgfhgoihccjhldnglmeeedfoopihm